> TODAY'S SUMMARY (22 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Fireworks AI has reported a breach stemming from a third-party cloud hack, emphasizing the risks associated with relying on external providers. France has attributed a cyberattack that affected supermarket refrigeration systems to Iranian operatives, signaling geopolitical tensions in cyberspace. Meanwhile, CISA has warned of active exploitation of multiple security flaws in key software, including OpenSSH and IBM products. Additionally, N-able has taken its N-central Cloud offline after the disclosure of 33 zero-day vulnerabilities. On the consumer side, a data breach at Iris Ohyama may expose personal information of 7.7 million individuals. Lastly, Google has issued a security update for Chrome, addressing the eighth actively exploited zero-day this year.
|
// AI-powered summary generated at 08:00
The ransomware group Nitrogen claimed responsibility for the attack and said it stole 8 terabytes of data spanning more than 11 million files belonging to the company’s top customers.
The post Major tech manufacturer Foxconn confirms cyberattack hit North American factories appeared first on CyberSc...
Exposed UIs, weak authentication, and risky defaults could turn cloud-native AI apps on Kubernetes into potential targets by threat actors. Learn how exploitable misconfigurations lead to RCE and data leaks.
The post When configuration becomes a vulnerability: Exploitable misconfigurations in AI app...
A group of likely Russian government hackers tried to hack a security researcher who investigates spyware attacks. He was then able to turn the tables on the hackers and reveal details of their espionage campaign.
This is Cisco's latest layoff in recent years, while the company's chief executive touts record revenue and growth.
For AI data centers, where the stakes are the highest and performance constraints are the tightest, security and performance are no longer a zero-sum game.
The post Enhancing Data Center Security Without Sacrificing Performance appeared first on SecurityWeek.
The Belarus-aligned threat group known as Ghostwriter has been attributed to a fresh set of attacks targeting governmental organizations in Ukraine.
Active since at least 2016, Ghostwriter has been linked to both cyber espionage and influence operations targeting neighboring countries, particularly...
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.
HYCU has announced HYCU aiR (AI Resilience), an AI-native solution that turns backup data across dozens of applications into a live and actionable intelligence for security, compliance, and IT teams. aiR lets organizations search, query, and run purpose-built agents to surface insider risk, sensitiv...
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed. For the stable distribution (trixie), this problem has been fixed in version 7:7.1.4-0+deb...
The vulnerability, tracked as CVE-2026-46300, is similar to the recently disclosed exploits named Dirty Frag and Copy Fail.
The post New Linux Kernel Vulnerability Fragnesia Allows Root Privilege Escalation appeared first on SecurityWeek.
Dr Fazeelat Duran explores how repeated exposure to distressing material affects law enforcement staff over time—and what organisations can do to better support them.
Google’s Android Advanced Protection Mode is getting a new feature allowing trusted security experts to investigate potential spyware infections
Researchers found a critical 18-year-old buffer overflow flaw in NGINX, tracked as CVE-2026-42945 and named NGINX Rift. If you run NGINX, and statistically speaking, there is a very good chance you do, this week brought news worth stopping for. Security researchers at depthfirst disclosed a critical...
Independent benchmarking finds Mythos highly effective for source code audits, reverse engineering, and native-code analysis, though its exploit validation and reasoning capabilities remain inconsistent.
The post Mythos Proves Potent in Vulnerability Discovery, Less Convincing Elsewhere appeared fir...
New Fragnesia kernel flaw lets unprivileged local users escalate to root on Linux systems
When a partitioning change to our petabyte-scale ClickHouse cluster caused critical billing jobs to stall, standard metrics showed no obvious errors. This post explores how we identified severe lock contention in ClickHouse's query planner and built upstream patches to fix it.
A widely active phishing-as-a-service (PhaaS) operation known as FlowerStorm has begun using a browser-based virtual machine to conceal credential theft code, marking what researchers say is an escalation in phishing-kit sophistication that could make attacks harder for tradit...
Hackers Targeted PraisonAI Vulnerability Hours After Disclosure Attackers began probing for CVE-2026-44338, a PraisonAI authentication bypass flaw, less than four hours after public disclosure. The issue affects PraisonAI versions 2.5.6 through 4.6.33 when the legacy Flask API server is exposed with...
The acquisition enables Akamai to expand its Zero Trust portfolio to add protection directly into the browser.
The post Akamai to Acquire AI and Browser Security Firm LayerX for $205 Million appeared first on SecurityWeek.